The concept of businesses being cyber-resilient is a significant question for many companies today, due to the growing complexity of cyber risks and vulnerabilities they face. High profile data breaches have shown the harm that hackers can inflict.
However, cybersecurity is no longer seen as a challenge for large enterprises alone, and for a very important reason: almost two-thirds of all cyber attacks are directed at small-midsize businesses1.
The 3 biggest misconceptions in SMEs about cyber security
“Our IT service provider takes care of our cybersecurity” – the most popular misconception. Many SMEs believe their IT service providers take care of everything, including security. In practice, that’s not how it works. Everyone within the client organisation is responsible for digital security, while overall responsibility lies with the firm’s management.
“Our staff can’t understand cybersecurity” - most SMEs assume that cybersecurity is beyond their personnel. However, the reason why people within a business do things the wrong way is that they don’t know better – a breakdown in communication is usually the main cause of this.
“If we’ve got a virus scanner and a firewall, we’re okay” - on their own, these simply don’t provide enough protection. A virus scanner can only flag up known threats, and a firewall is similarly incapable of keeping out all hazardous network traffic.
Why are SMEs the biggest target?
In the eyes of a cybercriminal small businesses are comparatively easy to attack. They may believe that SMEs won’t have the resources to protect themselves. Or that it is even necessary that they take steps to protect themselves – unfortunately, there is a degree of truth in this.
What’s more, add into the mix that big corporations are using progressively more sophisticated cyber security tools and techniques – after all, they’ve got the money to make it happen. This makes it increasingly difficult for cyber criminals to attack them. It’s not surprising, therefore that attacks on smaller-sized business are seen as a prime opportunity.
But it runs deeper than that - there are a few major reasons small businesses are particularly vulnerable to cyber attacks:
The first common reason is that they often can’t afford dedicated IT staff. And if they can, training and budgets are often inadequate – staff members need to be aware of attack methods, which they won’t be if resources aren’t provided for training.
Another is inadequate or non-existent computer and network security. Small businesses can’t respond or detect threats quickly enough if they don’t have the right infrastructure to do so – again, this often boils down to budgets.
And lastly, a lack of a backup plan. In assuming they’re not a high-profile target, many small businesses don’t use cloud services to back up their data offsite. A fatal error when the hacker closes in.
No target is too small
The costs and consequences of a cyber-attack can be devastating to a business of any size - but particularly an SME. Equally, however, with the right approach to security, no business is too small to defend itself.
Cyber Security Maturity Models are used to analyse a business’s ability to withstand cybersecurity threats, then provide planning measures and recommendations to dramatically improve how these threats are dealt with. It’s a crucially insightful approach, and in adopting a model approach like this, you’ll have the opportunity to take a step back and see a holistic view at all aspects of your cybersecurity maturity. You’re then in a prime position to back up your data, and consequently enable you to make a safe and speedy recovery if disaster strikes.
At Agile CIO Partners, our three-level Cyber Security Maturity Model examines businesses of all sizes and rates its cybersecurity preparedness. These three levels represent where a business like yours’ sits in terms of attack risk, and they exist because an approach like this can never be one-size fits-all. We’re here to provide you with a solution that’s specific to your business and tailored to your exact needs.
1. https://start.keeper.io/2018-ponemon-report